CVE-2026-78301

ISC BIND 9's named daemon incorrectly treats an NS or DNAME node placed above a zone's origin as a zone cut, so an attacker who can insert a malformed zone into an authoritative server (for example, via zone transfer or by loading zones on a shared DNS service) can make queries within that configured zone lose authoritative status and return an out-of-zone delegation. On servers that also provide recursion, BIND then follows this locally sourced, attacker-influenced cut and caches attacker-supplied data, poisoning answers for names outside the configured zone; the condition persists for as long as the malformed zone remains in the zone database. Any deployment running an affected BIND 9 version that combines authoritative service for attacker-influenceable zones with recursion, or that accepts zone transfers from less-trusted sources, is exposed. ISC assigned it CVSS 5.8 (medium) with high attack complexity and high privileges required, reflecting these preconditions. There is no evidence of exploitation in the wild, no known public proof-of-concept, and the flaw is not listed in CISA KEV.

What to do: Upgrade each affected BIND 9 branch to the first ISC-patched release after the last affected version listed for that branch (including the -S1 subscription branches). Meanwhile, restrict AXFR/IXFR zone transfers to trusted peers with TSIG-signed allow-transfer ACLs, run authoritative and recursive service on separate named instances or disable recursion on authoritative-only servers, and audit zone files and transferred zones for NS or DNAME records at or above the zone origin, removing any malformed zone and flushing the cache if found.